Cloudflare Tunnel vs ngrok (2026): Tested Comparison + When to Use Each
Free Cloudflare Tunnel vs $10+/mo ngrok: cost, setup time, reliability, CGNAT compatibility and Home Assistant use cases. Decision table included.
See the comparisonCloudflare Tunnel vs ngrok - the facts
| Cloudflare Tunnel | ngrok | |
|---|---|---|
| Cost (typical use) | Free + domain (~9 EUR/year) | Free: 1 tunnel, random URL; Hobbyist: 10 USD/month for stable URL |
| Stable URL across restarts | Yes (your domain) | Paid plan only - free rotates URL each launch |
| Setup time | 20-30 min (CF account, domain, tunnel, DNS) | 3 min (signup, ngrok http 8080, done) |
| Traffic inspection (debug) | CF dashboard logs (no body) | ngrok web UI (full request inspection - replay request) |
| Traffic / RPS limits | No limit on free for HTTP/HTTPS | Free: 40 req/min; paid: unlimited |
| Best for | Production, self-hosting, smart home | Dev/webhook testing, demos, presentations |
5 scenarios where CF Tunnel wins
Production - 24/7 stable service
CF Tunnel was designed as a production reverse proxy: stable URL on your domain, automatic Let's Encrypt SSL, built-in DDoS protection, no rate limit on HTTP. Free ngrok rotates URLs on every restart - useless for production. Paid ngrok works, but 10 USD/month + your config time > CF Tunnel free.
Self-hosting (HA, Jellyfin, Nextcloud) with a domain
Classic home-lab use case: you want `ha.home.com` instead of `random123.ngrok.io`. CF Tunnel gives you that for ~9 EUR/year (the domain), the cheapest paid ngrok (Hobbyist) is 10 USD/month = 120 USD/year. After 12 months the gap pays for a new Raspberry.
Global reach - 200+ PoPs
Cloudflare runs one of the largest edge networks. Your HA panel gets cached close to each visitor - cousin in the US sees the page in 30 ms instead of 150 ms direct. ngrok has fewer edges (US, EU, Asia) - significantly smaller reach. For globally-distributed users the gap is obvious.
Cloudflare Access (zero-trust SSO before the service)
CF Access gives you free (up to 50 users) Google/GitHub/Okta SSO BEFORE traffic hits HA/Jellyfin. ngrok offers similar OAuth but bills it per authenticated end user, and multiple seats need Pay-as-you-go. For self-hosters wanting an extra security layer, CF wins on price and depth.
Multiple services on one domain
CF Tunnel routes by SNI/host: `ha.home.com` → 192.168.1.10:8123, `jellyfin.home.com` → 192.168.1.10:8096, `files.home.com` → 192.168.1.20:80. All from one cloudflared daemon, one config. ngrok needs a separate tunnel per service - free caps at 1, paid charges per extra tunnel.
5 scenarios where ngrok is better
Dev / webhook testing
You're building a Stripe/GitHub/Slack integration and need a public URL to see what arrives. `ngrok http 3000` - 3 seconds and you have one. Plus ngrok's web UI shows every request with body, headers, replay support - debugging webhooks without ngrok is painful. CF Tunnel here is overkill (and slower to spin up).
Presentations / demos of a local app
Showing a prototype to an investor on another continent. `ngrok http 8000` - link works in 3 seconds, lasts for the demo. After the call you kill ngrok and the URL evaporates - clean. Spinning up CF Tunnel + DNS for a 30-min one-off is pointless.
Local app WITHOUT registering a domain
You don't have a domain and won't buy one for a small project. ngrok hands you a free `random.ngrok-free.app` URL - ugly maybe, but it works. CF Tunnel ABSOLUTELY requires a CF DNS domain. For quick projects ngrok has no real alternative.
Replay request - testing idempotency
ngrok's inspect UI lets you replay any request with one click - invaluable for testing webhook idempotency, retry logic, signature validation. CF Tunnel doesn't offer this - logs only. For async-integration dev work, ngrok is the default.
TCP / UDP tunnels (not just HTTP)
ngrok supports TCP/UDP tunnels on the paid plan - SSH, RDP, games. CF Tunnel handles TCP but only via `cloudflared access tcp` on the client side (not as a public URL). For "let my friend join my Minecraft server for an evening" - ngrok TCP, one click.
For self-hosting in smart homes
If your case is "I want family/clients to reach HA/Jellyfin/Nextcloud from a simple URL", SmartHomeEntry is built for exactly that scenario. Short subdomain `your-home.smarthomeentry.com` (like ngrok but stable), no domain purchase needed (like free ngrok), outbound-only agent with firewall-friendly policy (like CF Tunnel), EU-localised invoicing. For webhook dev - ngrok stays best. For production with your own brand - CF Tunnel. For 1-3 smart home installs without juggling domains - that's us.
Frequently asked questions
No. The URL changes on every ngrok daemon restart, so after a Raspberry reboot you'd be sending a new address to everyone. Plus the 40 req/min limit. For home production pick either CF Tunnel (free with your domain) or SmartHomeEntry (short URL with no domain required).
Yes: (1) Your domain must be registered or moved to CF DNS (NS change). (2) Cloudflare's TOS technically restricts non-HTML5 video streaming through their CDN - Jellyfin's transcoded streams sometimes hit this rule, though enforcement is rare in practice. (3) WebSocket connections have different timeouts than direct.
Yes, two: (1) ngrok's agent works even from very restrictive firewalls (HTTPS-only outbound), while CF cloudflared expects 7844/tcp. (2) ngrok has a native SSH gateway - `ssh [email protected]` as a proxy. CF doesn't have an out-of-the-box equivalent.
Both have had incidents. CF Tunnel: 2022 leak of confidential traffic for a small client pool (3h), patched. ngrok: 2020 user-enumeration issue. Both respond fast and have bug bounties. For home use the risk is comparable - the bigger risk is always a weak password in the underlying service (HA admin) than the tunnel itself.
CF Tunnel: Cloudflare has a DPA, EU-US Data Privacy Framework certified, Enterprise can enforce EU-only routing. ngrok: HQ in the US, DPA available on request, less granular geographic control. For small self-hosters the difference is academic; for EU-based companies CF is the better-documented choice.
See other comparisons
Short URL without domain setup and without 10 USD/month
SmartHomeEntry combines ngrok's quick start (one curl agent install) with CF Tunnel's stability (a stable URL for years). 7-day trial for 2 EUR.